Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CVE-2026-76139
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11 — Acm-operator-bundle: acm-operator-bundle: bundle build execs unpinned stolostron/release@master with full build credentials
AV AC PR UI S C I A CVSS EPSS %ile KEV
N H H N C H H H 8.0 .0072 52.3 —
AFFECTED
Product Versions Fixed
Red Hat Advanced Cluster Management for Kubernetes 2.11 unspecified 1787704547
Red Hat Advanced Cluster Management for Kubernetes 2.13 unspecified 1787712120
Red Hat Advanced Cluster Management for Kubernetes 2.14 unspecified 1787704476
Red Hat Advanced Cluster Management for Kubernetes 2.15 unspecified 1787738299
Red Hat Advanced Cluster Management for Kubernetes 2.16 unspecified 1787711895
Red Hat Advanced Cluster Management for Kubernetes 2.17 unspecified 1787704231
TIMELINE
Aug 19 Reserved by redhat
Aug 19 Published (CNA: redhat)
Aug 26 PATCH SHIPPED — CVE-2026-76139 (Red Hat Advanced Cluster Management for Kubernetes 2.11). Fixed in Red Hat Advanced Cluster Management for Kubernetes 2.11 1787704547.
Description
A flaw was found in acm-operator-bundle. The build process for this component downloads and runs a script from a remote source without verifying its authenticity or integrity. This script gains access to sensitive credentials, such as GitHub access tokens and registry passwords, used in the build environment. A remote attacker could exploit this vulnerability to inject malicious code, leading to unauthorized access to build resources and potential compromise of the resulting operator bundle.
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| August 19, 2026 | Reserved | Reserved by redhat |
| August 19, 2026 | Published | Published (CNA: redhat) |
| August 26, 2026 | PATCH SHIPPED | PATCH SHIPPED — CVE-2026-76139 (Red Hat Advanced Cluster Management for Kubernetes 2.11). Fixed in Red Hat Advanced Cluster Management for Kubernetes 2.11 1787704547. |
Affected
Affected products and packages — 6 rows
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.11 | — | — | 1787704547 |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.13 | — | — | 1787712120 |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.14 | — | — | 1787704476 |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.15 | — | — | 1787738299 |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.16 | — | — | 1787711895 |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.17 | — | — | 1787704231 |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-76139 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
